Re:Symantec to Buy Identity Theft Protection Company LifeLoc...
by dmix on Monday November 21, 2016 @05:47PM
(#13009969)
Of course an email provider can't be zero-knowledge. They're just a warrant, NSL, or social engineering away from disclosing the full contents of any (or all) persons email. Just like any other email service. And the metadata from any person using their service will be swept up by any security service listening in between without a warrant.
So the whole "private" thing is just baseless marketing.
Is this true? Is it possible, with current SMTP requirements? I'll give them the benefit of the doubt that they're not actively copying it for the purpose of keeping records they can give to someone else, or scanning it to insert ads.
But to act as a mail server, in my understanding of the state of the art, they need to take incoming mail in a format they can decrypt it - functionally equivalent to 'scanning' it. They need to store it on their servers - 'copy' it - so you can download it over POP3 (or IMAP, in which case it remains on the server).
I don't think it's possible to act as a no-knowledge mail server given current mail requirements without using PGP. And to do a bit of demographic analysis, the group of people who "Feel pride of owning an email address with Ronald Reagan's name" have a narrow intersection with the group of people familiar with PGP.